Tektronix TDS3012B repair help needed

[james_s]

Well that suggests that the ROM is ok since it says the checksum is good but I'm not sure how it checks that. I also have no idea how thorough the RAM check is, it may only do just enough to determine that all of the address and data lines are working and not necessarily test the entire range of memory.

[cpuchip]

Well that suggests that the ROM is ok since it says the checksum is good but I'm not sure how it checks that. I also have no idea how thorough the RAM check is, it may only do just enough to determine that all of the address and data lines are working and not necessarily test the entire range of memory.

Well I pulled the NVRam module out and it still registered it as check OK on both address and data lines. so... I think it might be looking for shorts there? as appose to actually having a chip to talk to.

I still haven't gotten it to respond to any input from serial. I'll have to verify my connection.. and I really need to order that connector.... I just got super impatient. I really want this darn thing to work!

[james_s]

Yeah that really doesn't give me a great deal of confidence in the usefulness of the self tests.

Sure would be nice if the boot ROM was socketed, that might make it feasible to develop a diagnostic ROM, some have been made for various vintage computers that will boot even with minimally functional hardware.

[sicco]

Well, i see progress. Strange that my unit, not a -b version but older, only gives the last two lines instead of the whole lot that Mr. cpuchip gets.
The UUUUU at the beginning - possibly to assist auto baudrate?

On the main board roms and no socket: as with the DS1742, many pins are also wired to the 100 pin expansion connector, the first rom all relevant pins except /CS, the second ROM all but D0-15, /CS, and /WE I think. The XPC860 in reset state makes it release the bus, so via an adapter in the expansion port and a few more patch wires, it’s maybe possible to read and/or reprogram the two AM29LV160 ROMs?

Before going there, let’s probe a bit deeper and see if the VxWorks monitor/debug backdoor cannot be unlocked any wider. Maybe there’s an Ethernet backdoor option also?

[sicco]

Aha - there is another huge backdoor potentially! Studied the XPC860 datasheet, it has JTAG,  BSD, and guess what, the 100 pin connector has 3 pins that connect to the XPC860 JTAG pins.

SRESET = 65
TCK = 64 (H16 of XPC860)
TDI = 63 (H17 of XPC860)
TDO = 62 (G17 of XPC860)

But then pin 61 I found at IRQ6, G3 of the XPC860. Maybe that's hard wired also to TMS, G18 of XPC860.

https://www.nxp.com/docs/en/reference-manual/MPC860UM.pdf , chapter Part VIII, System Debugging and Testing Support.
Quoting: "...dedicated user-accessible test access port (TAP), which is fully compatible with the IEEE 1149.1 Standard Test Access
Port and Boundary Scan Architectur..."

So that's how they program the flash roms in factory quite likely.

So, a JTAG adapter that ties into the 100 pins connector as per the above, and then...
But I don't have a JTAG probe or a JTAG / BSD / IEEE 1149.1 PC environment at hand... Are those just the 5-20$ USB modules listed on eBay when searching for JTAG? And then what software to support it?

[cpuchip]

I don't have a JTAG probe either, though it sounds like you can take a generic stm32 dev board and flash a jtag opensource firmware too it. I was thinking of picking up this little guy:
https://www.amazon.com/gp/product/B07ZK4LFTQ/ref=crt_ewc_title_dp_1?ie=UTF8&psc=1&smid=A28U2Z9L46X7LP

Okay sicco, how are you figuring out which pins on the XPC860 connect to the 100 pin expansion port?! I'm super impressed.
In a short few days I'd have to say this is the most informative TDS30xyz thread on here. Thank you so much for sticking with it I'm actually hopeful about reviving our scopes.

[sicco]

On how i figured out the pins - long story, but since you asked.... pmercier on forum elsewhere did the first 50+ pins, and I wanted to get a TDS3GM module for my TDS3034. Working as hobby project on a new plugin module that has a DS1744 for DS1742 replacement. Then I noticed on eBay the Israeli trader that had lots of ‘for spares’ ‘slightly’ damaged TDS3012, 3014, 3034, 3054 units for 200-600 EUR each. Dozens. Some with adapter boards in them. So I took a chance. And got a good TDS3EM module for 300 EUR. And a not working TDS3012 that came with it. I now know what de-militarized means. Thats what this lot from Israel is. Purposely damaged, axed, but also electrically demolished inside from the outside as I now know. Because others just like me (see post from madeo, Germany) suddenly needed a replacement TDS3012 front panel, because the NEC 78011 microcontroller on it that also does the 1 kHz probe calibration front panel signal, and all keys and knobs and leds, is dead. Dead I think because the demilitarizing basterds from Israel must have put AC mains or worse on that probe cal 1 kHz TTL clipon pad. In my case, also the mainboard must have died from that surge shock. Because swapping front panel with my good TDS3034 did not fix it. Except for no front panel, the Israeli scope seemed to worked ok though (gave good traces after providing external trigger signal by touching 50 Hz into its BNC EXTTRIG input, and a good single ch1 trace after fitting a blank DS1742.). So started to dig into how overvoltage into front panel pcb could damage also the mainboard. The I2C and other traces ended in 74LC86 that still looked good, and under the XPC860 BGA. I have an infrared rework station.... And guts. No guts no glory. eBay had XPC860 for 20 EUR from Poland. Never did BGA357, but decided it was time to go for it. Got the old XPC off ok. Sort of. But no joy yet getting a new one back in place. 357 pins is a lot. So that’s how i got the opportunity to beep from the BGA pins to the 100 pins connector.

[cpuchip]

wow Thank you for going through all that trouble to get the pin out on that TE header sicco. I've gone ahead and order my TE connectors and that JEFF probe jtag prob.

but today my scope is acting differing. I here a single relay click in and then out and now I have the 1KHz calibration port working the scope.

Interestingly enough when I boot the scope powering from the battery bay it draws 12v 1.28a 15w. but when the one relay (I only here one I think, I don't hear two) it jumps to drawing 20w 1.74a 12v. Interesting indeed.

also I am using PlatformIO's serial monitor this time and the scope is echoing what I type on the serial console and ctr-x does something

\\ scope draws 15w
sysClkRateSet using 50 MHz
excInit called
\\ scope draws 20w relays click
\\  typed ctr-x
cacheDisable (0);
Calling romInitsysClkRateSet using 50 MHz
excInit called
\\ scope draws 15 w
\\ no longer responds to console input.

before I was using putty.

[cpuchip]

So... I have the TDS3012B scope

when I have the ethernet ribbon cable de-attached to J910 I get what you got sicco on the serial port

sysClkRateSet using 50 MHz
excInit called
cacheDisable (0);
Calling romInit

But if I attach the the J910 Ethernet ribbon cable from the battery board to the main board I get this serial output, but my serial isn't echoed

␑UUUUUUUUUUUUUUUUUUUU
Boot flash checksum OK
Code flash checksum OK
0x00800000 bytes of RAM found
DRAM address line check OK
DRAM data line check OK
NVRAM address line check OK
NVRAM data line check OK
TBC ACQ SRAM address line check OK
TBC ACQ SRAM data line check OK
TBC Display SRAM address line check OK
TBC Display SRAM data line check OK
SuperI/O ID 0x000000b2
Loading Image
Uncompressing code from 0xffc40010 size 0x001e0927
Enabling cache
Entering usrRoot
Enabling the MMU
sysClkRateSet using 50 MHz
Enabling I/O system
excInit called

Do I have a bad battery board?

[Jwalling]

Here a couple of console outputs. One from a working scope, one not.

TDS3054B unknown firmware version, hangs at splash screen, no relays click, no floppy access:

UUUUUUUUUUUUUUUUUUUU
Loading Image
Boot flash checksum OK
Code flash checksum OK
0x00800000 bytes of RAM found
DRAM address line check OK
DRAM data line check OK
NVRAM address line check OK
NVRAM data line check OK
TBC ACQ SRAM address line check OK
TBC ACQ SRAM data line check OK
TBC Display SRAM address line check OK
TBC Display SRAM data line check OK
SuperI/O ID 0x000000b2
Uncompressing code from 0xffc40010 size 0x001ddaaa

TDS3054B Firmware 3.41 (working OK) Unit has TDS3GV module installed.

UUUUUUUUUUUUUUUUUUUU
Boot flash checksum OK
Code flash checksum OK
0x00800000 bytes of RAM found
DRAM address line check OK
DRAM data line check OK
NVRAM address line check OK
NVRAM data line check OK
TBC ACQ SRAM address line check OK
TBC ACQ SRAM data line check OK
TBC Display SRAM address line check OK
TBC Display SRAM data line check OK
SuperI/O ID 0x000000b2
Loading Image
Uncompressing code from 0xffc40010 size 0x001e0927
Enabling cache
Entering usrRoot 
Enabling the MMU
sysClkRateSet using 50 MHz
Enabling I/O system
excInit called
Class 17 Level 3  hwResetTBC(): Installing Machine Check Exception handler. 07:3
9:56 11/21/2020 (thread: StartUp)
TBC reset count = 0
 Doubling core clock ... complete
 Attaching network interface qu0... done.
Attaching network interface lo0... done.
NFS client support not included.
Starting VXI-11 service...Core channel...Abort channel...ready.

SAME working unit, running full self test from utility menu:

Class 5 Level 3   Diag: TestCpuCore  07:43:13 11/21/2020 (thread: exec)
Class 5 Level 3   Diag: CPURomChecksum  07:43:13 11/21/2020 (thread: exec)
Class 5 Level 3     Diag: Boot  07:43:13 11/21/2020 (thread: exec)
Class 5 Level 3     Diag: Code  07:43:13 11/21/2020 (thread: exec)
Class 5 Level 3     Diag: NV Memory  07:43:13 11/21/2020 (thread: exec)
Class 5 Level 3   Diag: TestAppKeyRead  07:43:14 11/21/2020 (thread: exec)
Class 5 Level 3   Diag: TestFDDReadWrite  07:43:14 11/21/2020 (thread: exec)
Class 5 Level 3   Diag: TestFPAccess  07:43:14 11/21/2020 (thread: exec)
Class 5 Level 3   Diag: TestIO  07:43:16 11/21/2020 (thread: exec)
Class 5 Level 3     Diag: GPIB  07:43:16 11/21/2020 (thread: exec)
Class 5 Level 3   Diag: TestTBCMemory  07:43:16 11/21/2020 (thread: exec)
Class 5 Level 3     Diag: Display  07:43:16 11/21/2020 (thread: exec)
Class 5 Level 3     Diag: Acq  07:43:16 11/21/2020 (thread: exec)
Class 5 Level 3   Diag: TestAcqContinuity  07:43:16 11/21/2020 (thread: exec)
Class 5 Level 3   Diag: TestAcqTrigger  07:43:20 11/21/2020 (thread: exec)
Class 5 Level 3   Diag: TestTBCVersion  07:43:33 11/21/2020 (thread: exec)

SPC produces no output.

Interesting to note that if I remove the dallas chip, there is no change to the console output on the bad unit.
It still says:

NVRAM address line check OK
NVRAM data line check OK

Must not be much of a test...

[cpuchip]

TDS3054B unknown firmware version, hangs at splash screen, no relays click, no floppy access:

Have you tried pulling the J910 ethernet ribbon cable like I did and get a different result on the serial debug console?

Must not be much of a test...

I'm guessing it's not either. Though I'm tempted to short like A0 and A1 together to see if it fails that test...? is that a stupid idea?

All of this Jwalling is super helpful to see what a normal scope looks like on it's output! I really appreciate it.

Is there a github project that's compiled some of this information? has someone started a KiCad or easyEDA project on a home brew TDS adapter board. My skills are not great yet, but I'm up for trying to create a debug board with a beefy STM32 processor that connects to ALL of the io lines available on the 100 pin TE connector. Has this been done before? If I can get my scope working it'd be fun to take it farther and make a useful board that has wifi (maybe an esp32, like a project I saw on another thread here)

Either way I feel like truly understanding what going on here is going to take quite a bit of input data from that connector board.

[james_s]

Don't try shorting anything together. Those address lines are driven directly by the CPU, some chips can tolerate shorted outputs but it's not guaranteed and if you blow out one of the address lines on the CPU it's game over. What would you expect to learn by doing that anyway? We already know the self test is not very useful.

[cpuchip]

You're right, I'm just trying to think of ways to validate that it's actually doing something.

[james_s]

You could put a logic analyzer on it and see what it's doing. I might try that at some point, I just have too many projects to go down that rabbit hole right now.

[Jwalling]

TDS3054B unknown firmware version, hangs at splash screen, no relays click, no floppy access:

Have you tried pulling the J910 ethernet ribbon cable like I did and get a different result on the serial debug console?

I have not, but I could. Which scope would you like me to try this on?

[sicco]

I'm diving into JTAG basics right now. Never did that before, but now that I've retired from oil and gas, it's about time I did, and sharpen up my 30 years of aged electronics hardware skills. Just started KiCAD two months ago... The plug-in board that I'm progressing is now at rev 4, it now got JTAG 10 pins header ports and I think I can even do a JTAG USB adapter with the FT232R chip that I had in it already for the serial port over USB. IF all goes well, then with this board plugged in, we can read and write any pin on the XPC860 CPU on the main board, and also read, erase, write the full flash ROMs (so including the boot loader that a firmware update by floppies does not I think).

To keep james_s from shooting: it has isolated JTAG, so we're unlikley going to damage hardware. But yes, once we erase the ROMs and fail to reprogram, yes, then of course...

See on what we'd possibly open up if this JTAG backdoor with a JTAG connector, possibly with the USB-JTAG dongle on the same Tektronix TDS3000 rearside panel plug-in board already!

Still looking for the JTAG BSDL file for the MCP860. Used to be a download from Freescale according to the MPC860UM manual. It states "45.7 Freescale MPC860 BSDL Description
The most current revision of the BSDL file for the MPC860 PowerQUICC is available at the Freescale web site (www.freescale.com)." But that was 20 years ago... Have asked on he NXP community forum, but no replies yet. Anyone has that BSDL file maybe?

Have put my hopes on http://www.topjtag.com/. 1 of my 20 'for free' trial days has lapsed... Would be great if that works (then no need to push/pull 100 pins connector pins from yet another STM32 or so, because the XPC860 will do that over JTAG? Is OpenOCD a better shot? What about Intellitech? Did order a "Altera Mini Usb Blaster avec Câble pour CPLD FPGA NIOS JTAG Altera Programmeur" as it looks like there's FT2232 and FT232 incompatibilities that might bite... Takes another 1 or 2 weeks before I have it...

Only thing that's a bit of a stumbling block now: there is no JTAG TMS pin on the 100 pins connector. Only TDI, TCK, TDO, HRST, SRST. It seems that TMS is hard wired to VDDL on the scope main board, right under the BGA, impossible to cut that track unless you'd de-solder the 357 BGA pins. So TMS hard wired to +3V3. What does that mean? Just that I cannot debug, but still can do flash and NVRAM and RAM read/writes? That would be good enough for me for now but is that what it is?

[cpuchip]

I have not, but I could. Which scope would you like me to try this on?

Both ideally, but at you're leisure since I'm in no rush on this (I figure it's going to take months to get this scope up, it's just something I work on every few days as a hobby)

I've just started learning KiCad myself so I can build a custom expansion board and another project I'm working on (reverse engineering the LCD interface on a Ti-86 calc)

I've been following Phil's Lab, did you have any helpful resources? Because.. you're design looks awesome. and... way ahead of mine (non-existent since I'm still just learning, and I have a full time Software Engineering job)

Still looking for the JTAG BSDL file for the MCP860. Used to be a download from Freescale according to the MPC860UM manual. It states "45.7 Freescale MPC860 BSDL Description
The most current revision of the BSDL file for the MPC860 PowerQUICC is available at the Freescale web site (www.freescale.com)." But that was 20 years ago... Have asked on he NXP community forum, but no replies yet. Anyone has that BSDL file maybe?

I found you're query here, I'm looking too. hopefully we'll fine it
https://community.nxp.com/t5/PowerQUICC-Processors/BSDL-file-for-MPC862P/m-p/995749

[cpuchip]

I think in this list, the file we're looking for is near the bottom
https://www.nxp.com/search?keyword=MPC860&start=0&category=software

but I cannot download it.
https://www.nxp.com/webapp/sps/download/license.jsp?colCode=MPC860BSDL&location=null
it's just a blank page.

[cpuchip]

Sicco, for good measure I submitted a support request from NXP for the missing/broken link on their website for the MPC860 BSDL file.

I will say this. I never want to use NXP processors. THEIR support pages and support process is 'your' company and product based and all of their IDE tools are behind pay walls. I much prefer other brands, like STM32 or even microchip, which seems to be much more open about the whole thing.

[cpuchip]

I think this is the file. WOW they did respond fast. within a few minutes.

[james_s]

Sicco, for good measure I submitted a support request from NXP for the missing/broken link on their website for the MPC860 BSDL file.

I will say this. I never want to use NXP processors. THEIR support pages and support process is 'your' company and product based and all of their IDE tools are behind pay walls. I much prefer other brands, like STM32 or even microchip, which seems to be much more open about the whole thing.

If you think that's bad try Broadcom. Even just getting datasheets usually requires NDAs.

[sicco]

OK, so we have the BSD file now. That's progress. I renamed the MPC860BSDL.txt to MPC860BSDL.bsd, and then it was 'approved' when importing by the TopJTAG programs that I use. 18 days left of my free period from TopJTAG friends... Still no Altera_USB_Blaster in the post today though. What's worse, I'm learning now that the MPC860 has two different 'engineering' back doors, one is JTAG= IEEE 1149.1=test access port (TAP), the other is  background debug mode (BDM), and was more proprietary Motorola and sort of preceded JTAG. They share the same pins - sort of. But only JTAG uses the TMS pin. And that is the pin that is pretty solidly hard wired to VDDL via a TDS3000 main board PCB track right under the BGA. So I fear JTAG is pretty much a dead end now. Unless someone is wiling to x-ray the main board right under the XPC860 BGA. I fear lots of mutilayer tracks will get hurt if I'v drill a hole from the bottom to reach this hidden pin TMS at BGA pin location G18 for adding a patch wire... Hmm. Do I really want to go there? Anyone any better idea? Like is that BDM interface (which I believe has all its pins on the 100 pin expansion connector) good enough to access the ROMs and RAMs, and to flash re-program the ROMs? Would expect so, because how else would Tektronix have flashed the ROMs at production time? But what hardware and software PC tools does that then require?? 

[Jwalling]

I have not, but I could. Which scope would you like me to try this on?

Both ideally, but at you're leisure since I'm in no rush on this (I figure it's going to take months to get this scope up, it's just something I work on every few days as a hobby)

With the ethernet flat cable disconnected, nothing at all is outputted from the console port on the scope that hangs.
On the working scope:

sysClkRateSet using 50 MHz
excInit called
Attaching network interface qu0... done.
Attaching network interface lo0... done.
NFS client support not included.
Starting VXI-11 service...Core channel...Abort channel...ready.

That's it. I was rather surprised at this... The scope finishes booting as well.

[YetAnotherTechie]

Anyone any better idea? Like is that BDM interface (which I believe has all its pins on the 100 pin expansion connector) good enough to access the ROMs and RAMs, and to flash re-program the ROMs? Would expect so, because how else would Tektronix have flashed the ROMs at production time? But what hardware and software PC tools does that then require??

BDM was pretty popular to debug all kinds of embedded motorola chips likw 68hc11 and 68hc900 family. What came up while searching for BDM info a long time ago were programmers that i think were basically a level converter for uart, but sold for hundreds $ because of the software that came with them for "bad stuff" like car radio decode and odometer programming.

You need dig back well into the nineties to find info.

[sicco]

Another small step forward: I can now get my TDS3054 (once a TDS3034, but now upgraded, so an older model, not a -b or -c, so no Ethernet inside) to say more on the TTL level 38400,n,8,1 on SMTXD1, pin 13 on the 100 pins expansion port. For that to work, I had to link SNI_RX (pin 16) to SNI_TENA (pin 17). With that, it immediately after power on reset emits this which is a lot more than it did before (when it did just two lines, after a wait of 10 seconds or so):


UUUUUUUUUUUUUUUUUUUU
Loading Image
Boot flash checksum OK
Code flash checksum OK
0x00800000 bytes of RAM found
DRAM address line check OK
DRAM data line check OK
NVRAM address line check OK
NVRAM data line check OK
TBC ACQ SRAM address line check OK
TBC ACQ SRAM data line check OK
TBC Display SRAM address line check OK
TBC Display SRAM data line check OK
SuperI/O ID 0x000000b2
Uncompressing code from 0xffc40010 size 0x001e0927
Enabling cache
Entering usrRoot
Enabling the MMU
sysClkRateSet using 25 MHz
Enabling I/O system
excInit called
Class 17 Level 3  hwResetTBC(): Installing Machine Check Exception handler. 12:05:41 11/25/2020 (thread: StartUp)
Class 7 Level 3  hwI2CAppKeySearch: new device I2C/APPKEY1 slot 1 addr 0xa0
 12:05:41 11/25/2020 (thread: StartUp)
Class 7 Level 3  hwI2CAppKeySearch: new device I2C/APPKEY2 slot 2 addr 0xa2
 12:05:41 11/25/2020 (thread: StartUp)
TBC reset count = 2


That's more useful! Sending CTRL-X to the SMRXD1 pin 14 makes it reset, reboot. Other than that it only seems to echo - so other than that nothing interactive yet.
If I unplug the purple cable to the front panel keyboard, then it says this in Putty:

0x0UUUUUUUUUUUUUUUUUUUU
Loading Image
Boot flash checksum OK
Code flash checksum OK
0x00800000 bytes of RAM found
DRAM address line check OK
DRAM data line check OK
NVRAM address line check OK
NVRAM data line check OK
TBC ACQ SRAM address line check OK
TBC ACQ SRAM data line check OK
TBC Display SRAM address line check OK
TBC Display SRAM data line check OK
SuperI/O ID 0x000000b2
Uncompressing code from 0xffc40010 size 0x001e0927
Enabling cache
Entering usrRoot
Enabling the MMU
sysClkRateSet using 25 MHz
Enabling I/O system
excInit called
Class 17 Level 3  hwResetTBC(): Installing Machine Check Exception handler. 12:04:07 11/25/2020 (thread: StartUp)
 I2C err I2CER 0x10 I2CAccessInProgress 0 fpStateVal 8 addr 0xee opcode 0x9 NAK 0x3804
 I2C err I2CER 0x10 I2CAccessInProgress 0 fpStateVal 7 addr 0xee opcode 0xe NAK 0x3804
 I2C err I2CER 0x10 I2CAccessInProgress 0 fpStateVal 7 addr 0xee opcode 0xf NAK 0x3804
Class 7 Level 3   I2C ERROR: Front Panel may not be connected  12:04:07 11/25/2020 (thread: Interrupt)
 I2C err I2CER 0x10 I2CAccessInProgress 0 fpStateVal 7 addr 0xee opcode 0xe NAK 0x3804
Class 7 Level 3   I2C ERROR: Front Panel may not be connected  12:04:07 11/25/2020 (thread: Interrupt)
 I2C err I2CER 0x10 I2CAccessInProgress 0 fpStateVal 7 addr 0xee opcode 0xf NAK 0x3804
TBC reset count = 3

Makes sense, it's I2C comms to that front panel board with its NEC78011, which must be the I2C slave at address 0xee. And those before at 0xa0 and 0xa2: My two option modules TDS3FFT and TDS3TRG that also sit on the front panel board. Bingo!

With the front panel cable back in, running the Diagnostics from the Utility page on the Tektronix:
Class 5 Level 3   Diag: TestCpuCore  12:04:56 11/25/2020 (thread: exec)
Class 5 Level 3   Diag: CPURomChecksum  12:04:56 11/25/2020 (thread: exec)
Class 5 Level 3     Diag: Boot  12:04:56 11/25/2020 (thread: exec)
Class 5 Level 3     Diag: Code  12:04:56 11/25/2020 (thread: exec)
Class 5 Level 3     Diag: NV Memory  12:04:56 11/25/2020 (thread: exec)
Class 5 Level 3   Diag: TestAppKeyRead  12:04:57 11/25/2020 (thread: exec)
Class 5 Level 3   Diag: TestFDDReadWrite  12:04:57 11/25/2020 (thread: exec)
Class 5 Level 3   Diag: TestFPAccess  12:04:57 11/25/2020 (thread: exec)
Class 5 Level 3   Diag: TestIO  12:04:58 11/25/2020 (thread: exec)
Class 5 Level 3   Diag: TestTBCMemory  12:04:58 11/25/2020 (thread: exec)
Class 5 Level 3     Diag: Display  12:04:59 11/25/2020 (thread: exec)
Class 5 Level 3     Diag: Acq  12:04:59 11/25/2020 (thread: exec)
Class 5 Level 3   Diag: TestAcqContinuity  12:04:59 11/25/2020 (thread: exec)
Class 5 Level 3   Diag: TestAcqTrigger  12:05:04 11/25/2020 (thread: exec)


So on the -b models, the Ethernet signals SNI_TENA and SNI_RX go to another board that has the Ethernet PHY chip. Unplugging that ribbon cable connector likely cuts the signal path SNI_TENA to SNI_RX which on my old scope (still?) go to 100 pins connector pins 17 and 16.

If you'd like to play it safe: also a 1 kOhm resistor between SNI_TENA and SNI_RX does the trick. But grounding or tying these pins to +3V3 does not do the trick.